feat(vaults): flag and skip wrong content keys from poisoned vaults

Verify a vault-sourced key with an FFmpeg decode after decryption. On failure flag the KID:KEY locally with its source, restore the ciphertext, and retry through the remaining vaults and then the CDM.

tests/core/test_vault_table_case.py

@@ -29,7 +29,9 @@ KEY = "a" * 32
 def tables(path: Path) -> list[str]:
     conn = sqlite3.connect(path)
     try:
-        return sorted(r[0] for r in conn.execute("SELECT name FROM sqlite_master WHERE type='table'"))
+        return sorted(
+            r[0] for r in conn.execute("SELECT name FROM sqlite_master WHERE type='table' AND name != 'bad_keys'")
+        )
     finally:
         conn.close()